Firewall audit failures are not edge cases anymore. They are the norm. Across industries, nearly 60% of firewalls fail at least one high-severity check during audits and internal assessments. These...
The post Why 60% of Firewalls Fail High-Severity Checks and How NSPM Fixes It appeared first on Security Boulevard.
Threat actors used two malicious Chrome extensions that have 900,000 users to steal their chats with AI models like ChatGPT and DeepSeek and browser history. The incident is the latest in a growing string of attacks in which hackers weaponized browser extensions to exfiltrate huge amounts of sensitive data.
The post Widely Used Malicious Extensions Steal ChatGPT, DeepSeek Conversations appeared first on Security Boulevard.
Apple’s App Store source map leak shows a preventable risk we found in 70% of organizations shipping production web apps.
The post Apple’s App Store Source Map Leak: A Preventable Vulnerability We Found in 70% of Organizations appeared first on Security Boulevard.
Session 7C: Secure Protocols
Authors, Creators & Presenters: Pengzhi Xing (University of Electronic Science and Technology of China), Hongwei Li (University of Electronic Science and Technology of China), Meng Hao (Singapore Management University), Hanxiao Chen (University of Electronic Science and Technology of China), Jia Hu (University of Electronic Science and Technology of China), Dongxiao Liu (University of Electronic Science and Technology of China)
PAPER
Distributed Function Secret Sharing and Applications
Function Secret Sharing (FSS) has emerged as a pivotal cryptographic tool for secure computation, delivering exceptional online efficiency with constant interaction rounds. However, the reliance on a trusted third party for key generation in existing FSS works compromises both security and practical deployment. In this paper, we introduce efficient distributed key generation schemes for FSS-based distributed point function and distributed comparison function, supporting both input and output to be arithmetic-shared. We further design crucial FSS-based components optimized for online efficiency, serving as the building blocks for advanced protocols. Finally, we propose an efficient framework for evaluating complex trigonometric functions, ubiquitous in scientific computations. Our framework leverages the periodic property of trigonometric functions, which reduces the bit length of input during FSS evaluation. This mitigates the potential performance bottleneck for FSS-based protocols incurred by bit length. Extensive empirical evaluations on real-world applications demonstrate a latency reduction of up to 14.73 times and a communication cost decrease ranging from 27.67 184.42 times over the state-of-the-art work.
______________ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.
The post NDSS 2025 – Distributed Function Secret Sharing And Applications appeared first on Security Boulevard.
Are Your Machine Identities Secure in the Cloud? More and more organizations are shifting their operations to the cloud. While this move optimizes business processes and enhances productivity, it also presents new challenges. One of the top concerns is the security of Non-Human Identities (NHIs), and managing them effectively is a critical aspect of robust […]
The post How Secure Are Your Machine Identities in the Cloud? appeared first on Entro.
The post Best of 2025: How Secure Are Your Machine Identities in the Cloud? appeared first on Security Boulevard.
Learn how the Oracle breach amplifies your risk from rogue cloud tenants plus how Grip helps organizations detect exposure and respond fast to mitigate risks.
The post Best of 2025: Oracle Breach: The Impact is Bigger Than You Think | Grip appeared first on Security Boulevard.
For the last twenty years, cybersecurity has been built around the edge: the belief that threats come from the outside, and that firewalls, WAFs, and API gateways can inspect and control what enters the environment.
That model worked when applications were centralized, traffic was predictable, and most interactions followed a clear pattern: a user in a browser talking to an app inside a data center.
Agentic AI breaks that model.
Today, AI systems don’t just generate responses — they take action. Agents trigger workflows, call APIs, update records, fan out across services, and interact autonomously with internal systems and third-party SaaS. That shift moves the risk inside the API ecosystem, where perimeter-based tools have limited visibility.
The Architectural Truth: The Perimeter Model No Longer Fits Modern TrafficLegacy perimeter tools were designed for a world with simple assumptions:
Agentic AI broke those assumptions almost overnight.
APIs already made every service both a client and a server. Agentic AI amplifies this by turning every LLM, MCP server, automation tool, and SaaS ecosystem into an active participant in your environment.
A single user request can now trigger:
This is no longer “north–south vs. east–west.” In the age of agentic AI, API traffic behaves more like a scene from Everything Everywhere All at Once — chaotic, multi-directional, and hard to predict.
The API Fabric: A Multi-Directional Mesh of Constant MotionIn the API fabric, every node is both client and server:
This means the most security-critical flows now look like:
Attackers don’t care about compass directions. They care about the fastest chain of APIs that reaches sensitive data.
Why Edge Security and WAAP Tools Miss Most of the Agentic AI Attack ChainNeither WAFs nor WAAPs were designed for:
Here’s what they see vs. what they miss:
Still feel secure? You might want to rethink your posture
Point solutions give snapshot visibility. Agentic AI creates continuous, dynamic API behavior. The gap between those two is now a systemic security risk
Why Multi-Directional Visibility Is Now MandatoryTo secure APIs — and the AI agents sitting on top of them — security teams need visibility into:
Agentic AI doesn’t attack your perimeter. It attacks your blind spots inside the API fabric.
Why Salt Security Is Built for the API Fabric (and for Agentic AI)Salt is purpose-built for this new world — designed around the API fabric itself, not a perimeter model.
Salt provides the multi-directional visibility and runtime intelligence required to secure agentic AI environments:
1) Observe API traffic where it actually runsAcross cloud environments, gateways, service meshes, MCP servers, and SaaS-driven workflows — including east/west and agent-created “off-axis” paths.
2) Reconstruct the real API fabricSalt rebuilds the operational truth: what APIs exist, who is calling them (including agents and SaaS tools), how data moves, and where risk accumulates.
3) Detect and stop what edge tools can’tSalt identifies high-risk behavior that perimeter tools miss, including misconfigured or over-permissioned agents, abnormal API chaining, new exposure from MCP integrations, and data exfil paths that look like “normal” workflows until you see the full chain.
Recent Salt capabilities reinforce this approach, including:
Agentic AI has shifted risk away from the perimeter and deep into the API fabric. Firewalls, WAFs, and gateways were never designed to observe or understand the behavior of LLMs, MCP servers, or autonomous agents moving across internal and SaaS-connected systems.
Security teams need to see every actor, every call, and every chain — not just what crosses the edge.
The edge is no longer where your risk lives. Your APIs are. And now, so are your agents.
If you want to learn more about Salt and how we can help you, please contact us, schedule a demo, or visit our website. You can also get a free API Attack Surface Assessment from Salt Security's research team and learn what attackers already know.
The post Edge Security Is Not Enough: Why Agentic AI Moves the Risk Inside Your APIs appeared first on Security Boulevard.
Zero-day vulnerabilities often attract attention and concern because of their unpredictability. They are, by definition, weaknesses that are unknown to software vendors and therefore have no official fix at the point of discovery. When discovered and exploited by malicious actors, they allow attackers to bypass controls before organisations even realise there is a problem. The…
The post Zero-day vulnerabilities: what they are and how to respond appeared first on Sentrium Security.
The post Zero-day vulnerabilities: what they are and how to respond appeared first on Security Boulevard.
how tenant isolation works in multi-tenant systems, with a deep technical focus on authentication, SSO, tokens, and infrastructure security.
The post Tenant Isolation in Multi-Tenant Systems: Architecture, Identity, and Security appeared first on Security Boulevard.
Introduction As the world is more and more switched to the availability of the internet, web browsers act as portals to numerous services and data. However, such conveniences mean the existence of certain risks. However, there is an emerging threat that is becoming worrying among cybersecurity professionals today, and these are ransom over browsers, whichRead More
The post Web Browsing’s Dark Side: Understanding Ransomware over Modern Web Browsers appeared first on EncryptedFence by Certera - Web & Cyber Security Blog.
The post Web Browsing’s Dark Side: Understanding Ransomware over Modern Web Browsers appeared first on Security Boulevard.
The State of Cybersecurity in the U.S. Healthcare (2024-2025) The U.S. healthcare sector is facing an unprecedented cybersecurity siege. Healthcare data, particularly Protected Health Information (PHI), remains one of the most valuable commodities on the dark web, often worth 10 to 50 times more than credit card data due to its permanence and usefulness in
The post Report: The U.S. Healthcare Cybersecurity Crisis and the Seceon Unified Platform Solution appeared first on Seceon Inc.
The post Report: The U.S. Healthcare Cybersecurity Crisis and the Seceon Unified Platform Solution appeared first on Security Boulevard.
Cyberattack continued to climb worldwide in 2025. Organizations saw an average of roughly 1,900 – 2,000 attacks per week. Compared to 2024, it’s a mid-single-digit percentage increase. Certain regions experienced especially sharp growth. For example, Europe’s attack volume jumped ~22% year-over-year. Critical infrastructure remained a focal point; approximately 70% of all incidents involved organizations in […]
The post Top Sectors Under Cyberattack in 2025 appeared first on Kratikal Blogs.
The post Top Sectors Under Cyberattack in 2025 appeared first on Security Boulevard.
Explore post-quantum cryptography in federated learning for Model Context Protocol training. Learn about quantum vulnerabilities, security measures, and real-world applications.
The post Post-Quantum Secure Federated Learning for decentralized MCP training. appeared first on Security Boulevard.
How Do Non-Human Identities Shape Enterprise Security? What role do Non-Human Identities (NHIs) play in safeguarding enterprise security? With digital evolve, understanding and managing NHIs becomes imperative for organizations seeking robust security measures, especially those operating in cloud environments. NHIs refer to machine identities, encompassing encrypted passwords, tokens, or keys that function as unique identifiers, […]
The post How scalable is Secrets Management for large enterprises appeared first on Entro.
The post How scalable is Secrets Management for large enterprises appeared first on Security Boulevard.
Can Non-Human Identities Enhance Security in High-Risk Environments? One intriguing question is whether Non-Human Identities (NHIs) can effectively reinforce security measures in environments considered high-risk. NHIs, often understood as machine identities, encompass secrets like encrypted passwords, tokens, and keys that provide unique identifiers. They function analogously to a passport with permissions akin to a visa, […]
The post What measures protect NHIs in high risk environments appeared first on Entro.
The post What measures protect NHIs in high risk environments appeared first on Security Boulevard.
Why Are Non-Human Identities Crucial for Cloud Security? How do organizations ensure robust security when integrating complex technologies like Agentic AI into their infrastructure? This is a pivotal question, especially when considering cloud security and the management of Non-Human Identities (NHIs). NHIs, representing machine identities combined with their respective secrets and permissions, stand at the […]
The post How secure are Agentic AI systems in handling sensitive data appeared first on Entro.
The post How secure are Agentic AI systems in handling sensitive data appeared first on Security Boulevard.
How Does Machine Identity Security Foster Confidence in Cybersecurity? Is your organization truly equipped to handle the complexities of machine identity security? While we navigate a rich with digital transformations, the importance of securing non-human identities (NHIs) cannot be overstated. NHIs, often referred to as machine identities, carry the same critical role in cybersecurity as […]
The post Can I feel confident in the security of machine identities appeared first on Entro.
The post Can I feel confident in the security of machine identities appeared first on Security Boulevard.
Session 7C: Secure Protocols
Authors, Creators & Presenters: Xuanji Meng (Tsinghua University), Xiao Sui (Shandong University), Zhaoxin Yang (Tsinghua University), Kang Rong (Blockchain Platform Division，Ant Group), Wenbo Xu (Blockchain Platform Division，Ant Group), Shenglong Chen (Blockchain Platform Division，Ant Group), Ying Yan (Blockchain Platform Division，Ant Group), Sisi Duan (Tsinghua University)
PAPER
Rondo: Scalable and Reconfiguration-Friendly Randomness Beacon
We present Rondo, a scalable and reconfiguration-friendly distributed randomness beacon (DRB) protocol in the partially synchronous model. Rondo is the first DRB protocol that is built from batched asynchronous verifiable secret sharing (bAVSS) and meanwhile avoids the high O(n^3) message cost, where n is the number of nodes. Our key contribution lies in the introduction of a new variant of bAVSS called batched asynchronous verifiable secret sharing with partial output (bAVSS-PO). bAVSS-PO is a weaker primitive than bAVSS but allows us to build a secure and more scalable DRB protocol. We propose a bAVSS-PO protocol Breeze. Breeze achieves the optimal O(n) messages for the sharing stage and allows Rondo to offer better scalability than prior DRB protocols. Additionally, to support the reconfiguration, we introduce Rondo-BFT, a dynamic and partially synchronous Byzantine fault-tolerant protocol inspired by Dyno (S&P 2022). Unlike Dyno, Rondo-BFT provides a communication pattern that generates randomness beacon output periodically, making it well-suited for DRB applications. We implement our protocols and evaluate the performance on Amazon EC2 using up to 91 instances. Our evaluation results show that Rondo achieves higher throughput than existing works and meanwhile offers better scalability, where the performance does not degrade as significantly as n grows.
ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.
The post NDSS 2025 – Rondo: Scalable And Reconfiguration-Friendly Randomness Beacon appeared first on Security Boulevard.
A high-severity flaw in MongoDB instances could allow unauthenticated remote bad actors to leak sensitive data from MongoDB servers. Dubbed "MongoBleed," the security flaw is being exploited in the wild after a PoC exploit and technical details were published. MongoDB has released patches to protect against exploitation.
The post Threat Actors Exploiting Critical ‘MongoBleed’ MongoDB Flaw appeared first on Security Boulevard.
via the comic artistry and dry wit of Randall Munroe, creator of XKCD
The post Randall Munroe’s XKCD ‘Website Task Flowchart’ appeared first on Security Boulevard.
